medium
advisory
Docker Buildx and Docker Desktop security updates
Docker has addressed a security vulnerability in Docker Buildx where bake filesystem entitlement consent is bypassed when using the --progress=rawjson flag, alongside other general security updates for Docker Desktop.
Triage facts
Revision 1- Applicability
- Docker Buildx (< 0.37.2), Docker Desktop (< 4.98.0)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 4 public sources
- Freshness
- Revision 1Nov 4, 22:03 UTC
- Source quality
- A1Likely
Docker has released security updates for Docker Buildx (versions prior to 0.37.2) and Docker Desktop (versions prior to 4.98.0). The Buildx vulnerability involves a bypass of bake filesystem entitlement consent occurring when the --progress=rawjson flag is utilized. Users and administrators should update to the latest versions to ensure these fixes are applied.
Recommendation
- Update Docker Buildx to version 0.37.2 or later to mitigate the filesystem entitlement bypass.
- Update Docker Desktop to version 4.98.0 or later to ensure all security fixes are applied.
- Review the official Docker security announcements for further details on patches and releases.
Mitigations
Upgrade Docker Buildx to 0.37.2 or later
immediate
IT Operations
GHSA-gwr2-q96m-6682
Upgrade Docker Desktop to 4.98.0 or later
immediate
IT Operations